FERPA: Privacy of Records

FERPA – Right to Privacy

What is FERPA? FERPA stands for the Family Educational Rights and Privacy Act of 1974. This federal legislation protects the privacy of your student records and regulates how information is used. Release of student records at Oregon State University is bound by FERPA, the Oregon Revised Statutes, and by the Oregon Administrative Rules.

*Students' FERPA rights begin when they are considered a student at OSU. The institutional definition of a student is when an individual has registered for START or has registered for classes, whichever comes first. This applies to all students, regardless of age or degree status.

To learn more about FERPA, please review these sources:

Student Consent to Release Information (formerly known as Joint Consent Form)

Student Consent to Release Information: This form is used by the Office of the Registrar, Office of Financial Aid, Office of Business Affairs, Office of Admissions, and Academic Advising for sharing information with designated third parties. Filling out this form does not initiate any action to send information; third parties will need to request information from the relevant department(s).

Confidentiality

NO information may be released about students who have established confidentiality of their records.

Students may restrict the release of their student information by completing a Confidentiality Request form. The Confidentiality Restriction prevents employees of OSU from providing any information, directory or confidential, to anyone who does not have a legitimate educational interest. When a confidentiality restriction is in place we can only discuss a student’s record with the student if they are present in person with picture identification or via live video chat. For students who have a confidentiality restriction in place but are unable to visit the office in person, the student may communicate with OSU offices via their OSU-issued email address (ONID name @ oregonstate.edu). Confidentiality does not mean anonymity in classes at OSU. 

CORE Reports on FERPA Training

Two CORE reports help in identifying if an employee (including student employees) has taken and passed their FERPA training.

BIC2910: searches all employees in a selected organization

BIC2911: search by ID numbers to see who has taken and passed their FERPA training.

Note: Results do not display immediately. Please allow up to 48 hours after the passing of one's training for information to appear in CORE.

Using Secure Credentials at OSU

OSU provides all employees and students with oregonstate.edu email accounts that have been vetted for appropriate security measures to protect data. These oregonstate.edu email accounts link to a verifiable identity established with the University and meet the Family Educational Rights and Privacy Act for authentication. Third-party, personal accounts are not able to be verified as linked to a particular individual and, therefore, should not be used in discussing any student record information.

Guidelines for Release of Information

If you receive a request for information follow these guidelines to determine what, if any, information can be released.

Data Security

The Office of Information Security provides comprehensive education on securely storing and transmitting data.

Retention & Statistics

This provides information about record retention requirements and statistical information available for the university.

Power of Attorney

The OSU Office of the Registrar does not accept Power of Attorney documents as a substitute for a consent to release information. If a student is unable to conduct their required interactions with the University for a particular reason, the student or student's representative should contact the Office of Student Life.

 

FERPA FAQs - Faculty & Staff

The Office of the Registrar serves as the steward of student education data. Part of responsible stewardship is ensuring that those to whom the stewards provide access to student education data demonstrate proficiency in understanding their responsibilities under the Family Education Rights and Privacy Act (FERPA) of 1974. To ensure we are in compliance with federal law, the institution must have documentation that employees with access to student education data have successfully passed FERPA training. If someone completed FERPA training prior to January 2005, we will not have record of their proficiency and the employee or designated agent will be asked to take the training and quiz, as the law has changed since 2005. Additionally, we highly encourage parties to reengage in FERPA training biannually to remain current with one's FERPA knowledge.

Use of students' email addresses is acceptable for academic and educational purposes; the students' oregonstate.edu addresses are the only officially recognized OSU email addresses and are available on Banner and Canvas rosters. Further, OSU-issued email addresses for faculty and staff are the only officially recognized email addresses and should be used for all university-related business. Email addresses other than OSU-issued email addresses are not directory information and cannot be released. Use of students' OSU-issued email addresses is acceptable for academic and educational purposes, and they must only be distributed to people who have an educational need to know.

Yes, it does. When you send email to a list of students in the To: line, then everyone can see all of the members on the list. It is important to exclude confidential students from the list. Then, you can send an individual email, with the same content as for all the other students.

Unfortunately, this does not display in Canvas. To check if a student is confidential, you will need to go to Online Services -> Faculty & Advisors -> Summary Class List. There you will see if a student is confidential, as displayed in the image below:

 

inkedeileenconfidential_li.jpg

image showing how to see that a student is confidential

You cannot add the other instructor as a CanvasTA, as that instructor can see student education data to which they do not have an educational interest. However, you can still allow the instructor to see the course content by adding the instructor as a Designer. For more information on this, please contact the Canvas Support team.

You may post grades as long as only you and the individual student know who the grade is for. That is, you cannot use the students' names or their Student ID numbers. You can create a unique identifier (such as a number, NOT part of the Student ID number) for each of your students and post grades by that identifier. Be sure NOT to arrange the list in alphabetical order, even though the names are not printed.

Confidential status is not the same as anonymity. If a student fills out a confidentiality request at OSU, that means that OSU will not release any information, non-directory or directory, to anyone outside of OSU and/or anyone that does not have a legitimate educational interest. For example, if a confidential student does an internship for credit with a local school district, the internship supervisor would know that the person was a student at OSU because that supervisor has a legitimate educational interest since the supervisor would be providing input on the grade for credit. However, if that same school district asked for a list of graduating Education majors from which to recruit, we would not release that student's name.

Distributing students' exams and papers in this way violates their confidentiality by making confidential records available to the public. This is not an acceptable practice.

Yes, you can. However, there are some guidelines to consider. Please see this resource guide on how to do so while maintaining students' FERPA rights.

Yes, you can. You may ask to see documentation of a medical visit or other visit to justify the excuse. We, however, advocate that you do not keep the documentation, as then you become responsible for the proper and secure storage of the documentation.

You cannot discuss any specifics about the student's grades. Use a conditional response: "If a student in my class earned a D-, I would suggest…" You also can advise the parent on how the student can see their grades: Web or student transcript from the Office of the Registrar.

When someone becomes an OSU student, regardless of their age, they must consent to the release of their records. The K-12 FERPA rules do not apply to a student under the age of 18 who enrolls in an institution of higher education. The student must provide consent to release information, even to their parents.

While federal law authorizes the release of records to parents of dependent students, it does not require it. Oregon statute does not include release to parents as an authorized disclosure; since state law is more restrictive than the federal law, the university is bound by the state law. Without explicit student consent, only directory information may be released to parents of dependent or independent students. This includes those students who are under age 18.

Only the same information as if the person were still enrolled as a student. Be sure to check whether the student had requested record confidentiality before leaving the university; if so, the confidentiality remains in effect.

No. A student, whether current or former, remains confidential until they revoke the confidentiality request.

When a student dies, FERPA no longer applies, but since there may be other issues related to disclosure, the inquiry should be referred to the Office of the Registrar.

A student's permission is required to release their records to these representatives. Refer the caller to the Office of the Registrar.

The USA PATRIOT Act (2001) and other legislation specify guidelines for release of information. Refer all such inquiries to the Office of the Registrar so that we can assure appropriate compliance.

You can discuss information provided to you by the student, such as information from their resume, and information that you have gained in your academic relationship with the student. You cannot discuss any non-directory information (e.g. their grade in a course you taught) without the student's specific written consent.

It is best practice to have a clause about FERPA on your scholarship application to expedite this process. This phrase may read something like: "The Family Educational Rights and Privacy Act of 1974 (FERPA) protects students' privacy over their education records. With some scholarships, the donor wishes to know who received the scholarship, as well as information about the recipient. Additionally, our College wishes to publicly celebrate our recipients on our various media. Do you consent to the release of your scholarship application information for these purposes?"

Yes, major is directory information as are student name and current address. The current address is maintained by the student, and may be the student's address in Corvallis or at some other location. Other addresses are not releasable. You should address your request for this information to the Office of the Registrar. For more information on requesting information, see our Data Requests page.

Student organizations should work with Student Leadership and Involvement on submitting requests for this data. The contact for these type of requests is Brittany Nefcy.

Refer all such requests to the Office of the Registrar.

Have a question you think should be added here? Email us!

FERPA Training Module

Overview

The Office of the Registrar hosts a FERPA training module and a required quiz for employees and courtesy appointees to gain access to student information systems. The training is recommended for any employee or courtesy appointee who works with students.

  • Individuals should participate in the training relevant to their designated role.
  • If you are a supervisor of a student serving in a role that encounters student data and the student is not an employee of OSU, please contact the Office of the Registrar for assistance.
  • In order to gain access to student information systems, including Canvas sections in which you are not a student, you must have a formalized role with the university.
  • If you have just joined the university as an employee, wait until you have the training tab in your MyOregonState employee tab before taking the training.

FERPA Training Access

There are three training modules:

  1. General employees (staff, teaching and professional faculty, administration, courtesy appointees) and,
  2. Student employees (TAs, GTAs, student workers)
  3. Non-OSU employees
EMPLOYEES & COURTESY APPOINTEES STUDENT EMPLOYEES NON-OSU EMPLOYEES
Step 1: Once in the “Employee” section of MyOregonState, select 'Resources' Step 1: Take this FERPA training
Step 2: Select the 'Employment' tag Step 2: Send proof of your training to your department leadership.
Step 3: Locate and select the appropriate link “Faculty/Staff FERPA Training” OR “GRA, GTA, & Student Employee FERPA Training”   
Step 4: You will be directed to a Qualtrics survey that may ask you to authenticate if you are not currently logged into DUO  
Verifying an Employee's FERPA Training

You can check to see if an employee or courtesy faculty member has completed their training by checking these CORE reports.

Guidelines for Release of Information

What can I release?

The following steps provide a simple means to determine what information may be released. Release of any information other than that listed in Step 3 may have serious legal implications. If you receive a request for information other than what is covered in these steps, refer the inquirer to the Office of the Registrar. Refer ALL inquiries under the USA PATRIOT Act to the Office of the Registrar.

All access and use at Oregon State University of the Social Security Number is prohibited except for meeting federal or state requirements, compliance and reporting.

You may copy these guidelines as needed, or request additional copies from the Office of the Registrar. We suggest that you keep a copy for  reference.

Step 1

Check the confidentiality of the student's records. Has the student restricted the release of all information?

  • Look at the grade roster or class roster. If a student's record is confidential you will see a dash before the student's name.
  • Sign on to Banner. If this student's information is confidential, Banner will show *CONFIDENTIAL* in the upper left portion of the form.
  • If you do not have access to Banner, ask someone who has access to check the student's record for you, or call the Office of the Registrar for help.

Step 2

If the student's record is CONFIDENTIAL, you must respond to the inquiry in a way that does not acknowledge the student's existence on campus. Example: "There is no information available on that person." If the person inquiring persists, you might suggest that they ask the student in question to contact the Office of the Registrar directly, or refer the caller to the Office of the Registrar.

Step 3

If the student's records are NOT confidential, then determine what information about the student is being requested. Oregon State University will provide only the following  Directory Information to all inquiries without students' written consent. Non-directory Information may not be released without written consent.

Step 4

If anything other than the above information is requested, the request should be denied. Refer all inquiries from law enforcement officials directly to the Office of the Registrar.

NO information may be released about students who have established confidentiality of their records.

 

OtR Guidance on Student Access to Other Students' Education Data

At OSU, we take protecting student education data seriously. In each instance where we provide an individual access to student education data (other than their own), we must assess what legitimate educational interest exists to justify providing access. The following are guidelines we follow when considering requests to provide students access to other students’ education data:

First, we consider whether the student is an employee of the institution.

  • If the student is an employee of OSU, does the student need access to the data requested in order to fulfill their professional responsibilities?   

If the student is not an employee of OSU, we ask about the level of the student (e.g. undergraduate, graduate).

  • If the student is a graduate student and needs access to student information to complete a curricular requirement (e.g. practicum or internship credit), we need documentation of the experience. This will likely take the form of a learning contract, where the description of duties and how those duties require access to student education data are clearly described. Further, this should include a statement about how the student accepts their responsibilities to protect student data under FERPA. This document also requires both the signature of the student and the student’s supervisor/advisor for the experience.
  • If the student is an undergraduate student who is not an employee of OSU, there is no permissible access to identifiable student data.

 

Directory Information

The following directory information is public record and may be released to any inquiry, unless the record in Banner is marked as confidential.

Student's name

Current mailing address (CM address in Banner) and telephone number 

OSU ONID email address

Campus office address

Student's home city, county, state, country

Class standing (e.g., freshman, sophomore, etc.)

Student level (undergraduate, graduate, etc.)

College

Major field of study 

Honors

Full-time or part-time enrollment status

Status as a graduate teaching assistant or graduate research assistant and hours of service

Participation in officially recognized activities and sports

Dates of attendance

Anticipated graduation date

Degrees and awards received

Date(s) of degree(s)

Most recent previous educational institution attended by student

These policy guidelines are in accordance with Oregon Revised Statutes (ORS 351.065), the Federal Family Educational Rights and Privacy Act of 1974 (PL 93-380) [34 CFR Part 99], and Oregon Administrative Rule 576-020-0005.

Limiting what appears on the directory

You can still limit what appears on the directory even without a confidentiality request. To do so, go to MyOregonState, click Resources, and click on 'Directory Profile.'

This will take you to your Profile. Scroll down to the bottom of the page where you see the 'Other' section and click 'Directory Profile.'

This will show you a list of directory items. With the exception of your name and, if you are an employee, your employee data, you are able to check or uncheck what information you want displayed in the directory. Click 'Update' to save these changes.

Non-Directory Information

This information is protected and MAY NOT BE RELEASED. If there are unusual and extraordinary circumstances refer the request to the Office of the Registrar, B102 Kerr Administration Building, 541-737-4048.

Student's Gender

Current email address (not ONID email address)
Month and day of birth

Transcript: Official or unofficial

Transcript: Student copy

Social Security Number (complete or partial)

Student ID Number (whether SSN or generated ID). All access and use at Oregon State University of the Social Security Number is prohibited except for meeting federal or state requirements, compliance and reporting.

Grades earned

Credits earned

Graduation status; course work yet to be completed (Cannot report whether student has applied for graduation)

Residency status

Fees paid

Holds (registration or other)

Class rank

Current academic status (probation; suspension; petitions; readmit status. That a student has applied can be released, but the status of the application cannot be released.)

VA, Social Security Status

GPA (Grade-Point Average)

Class schedule

Parent or guardian name or address

All other information about a student

These policy guidelines are in accordance with Oregon Revised Statutes (ORS 351.065), the Federal Family Educational Rights and Privacy Act of 1974 (PL 93-380) [34 CFR Part 99], and Oregon Administrative Rule 576-020-0005.

Records Retention & Statistics

Information Online

Learn more about alert notification, directory information, registration information, and more at Student Records-Right to Privacy in the Academic Catalog.

Records Retention

What records do we retain? How long do we keep them? Refer to the General Records Retention Schedule that govern the maintenance of Curriculum and Instruction Records, Financial Aid Records, Students Records, and more. [Note: This link may not work in IE. Try Firefox and Google Chrome.] The Oregon Secretary of State records retention schedule is located here. It offers more specific retention requirements.

Statistical & Historical Data (Institutional Research)

Enrollment rates, graduation rates, and other data are provided by Institutional Research.

FERPA Resources

FERPA can be confusing at times. We created this page to provide you with resources to better understand and uphold FERPA as it pertains to your professional responsibilities at Oregon State University.

FERPA tips for Instructors/Teaching Faculty

FERPA release template: This can be used by departments for releases for letters of recommendation, job references, et. al. These should be customized for and retained by the department.

Audio and Visual Recording in an Education Setting

Instructional Use of Social Media Policy

EdSurge article: The Unintentional Ways Schools Might Be Violating FERPA

Resources will be added periodically. If there's something you'd like to see here, please contact us!

  • class rosters
  • student course schedule/enrollment in courses
  • graded assignments (in any medium)
  • emails exchanged with a student concerning their academic progress (i.e. in a class, as an advisee)
  • card swipe data (e.g. in advising offices, at campus events)
  • signed ESET data
  • field site/internship evaluations for experiences done for course credit
  • advising notes
  • clicker data
  • student registration holds
  • student ID photos
  • audio or video of students participating in a class activity

Audio and Visual Recording in an Education Setting

FERPA protects the privacy of students education records.

Education records are defined as records that are: (1) directly related to a student; and (2) maintained by an educational agency or institution, or by a party acting for the agency or institution. A/V recordings made in an education settings meet this definition.

This decision tree is intended to assist the OSU community in determining whether consent of the students is required prior to the recording and whether the Office of the Registrar and/or the Institutional Review Board must review the project.

Details Related to the Decision Points

Any institution that receives federal funds from the DoE, which is most institutions of higher and secondary/elementary education, is subject to FERPA. The institution includes spaces that may be beyond the campus or regularly designated space of the institution. For example, prior consent of students must be obtained if recordings of fieldwork will be made or used for research purposes. Review and approval must be sought from the Institutional Review Board (IRB) and the Office of the Registrar (OtR).

Any student who is captured in a recording in some way is protected by FERPA. Plans to segregate students, blur captured images, or omit data from recordings taken of non-consenting students miss the point of requiring informed consent.

If yes, researchers will need to fill out a data feasibility form for the OtR and submit an application to the IRB.

Audio and video recordings of students in an education setting cannot be used for purposes other than evaluation and assessment without prior informed consent from each student in the setting. Student participation must be voluntary and their decision not to participate must be respected. Students may choose not to participate for a variety of reasons and those reasons need not be shared with the researchers. Strategies to avoid recording students who do not want to be recorded disrupt the learning experience, do not uphold the principle of respect for persons, and fail to adequately address the requirements under FERPA. 

Student consent may also be required when recordings are intended for non-research purposes but may result in disclosure of student education information to parties outside of the institutional setting. Contact the Office of the Registrar for more details.

When recordings are strictly for internal evaluation, assessment, or to improve services or instruction, consent may not be required. Please contact the OtR via data request for a determination.

If these recordings are not used for research, nor are they for assessment, evaluation, or services improvement reasons, please contact the IRB and OtR to ensure no further oversight is required.

OSU Office of the Registrar:  http://registrar.oregonstate.edu/

OSU Human Research Protection Program & IRB Office:  http://research.oregonstate.edu/irb

Data request form: http://bit.ly/OtR_data

American Association of Collegiate Registrars and Admissions Officers Ask the FERPA Professor:  https://www.aacrao.org/resources/newsletters-blogs/aacrao-connect/article/ask-the-ferpa-professor-5-30-2017

University of Wisconsin - Madison IRB Guidance: Video Recording in Campus Classrooms:  https://kb.wisc.edu/sbsedirbs/page.php?id=42377

Instructional Use of Social Media Policy

The Family Education Rights and Privacy Act of 1974 (FERPA) outlines the protections of a student’s education record. This includes any graded work completed as a part of the student’s registration in a course. Courses that use social media or other online tools for course engagement must either: a) create an environment only accessible by those in the class, b) obtain student consent to display identifying information about the student and their enrollment in the course or c) anonymize the student’s enrollment in the course.

**Note:  FERPA violations involve releasing education data that is not considered directory information. E.g., You write the name of the course on a blog and ask students to post on the blog—this displays that a student is enrolled in the course, which is protected data under FERPA. This would not be acceptable unless students consent to having their names appear on the course blog. However, you may remove the name of the course on the blog and ask students to post on the blog. Note that any student with a confidential flag cannot be expected to use their name for course work that will appear publicly.

Methods for obtaining consent:

In your course syllabus, note that the course will engage with online tools that may display the name of the course, the University, and/or student name(s). Ask students to provide consent to determine if they would like to participate in the public forum. If there is no way for students to participate without consenting to release their education data, the use of the tool is not permitted. Students cannot be penalized for refusing to consent.

Other ways to use online tools without obtaining student consent:
  • Create a private environment that will not be accessible to those not registered for the course.
  • Ask students to create a pseudonym at the beginning of the term that only you will know.
  • Remove any course and University designation from the page, group, hashtag, et. al.
  • Ask students to turn in their submissions to the site, forum, or other online tool directly to you.